Function parse

core/engine/packet.go:41–84

parse extracts IPv4 and TCP fields from raw. Returns a pkt whose slices alias raw — do not modify the returned pkt.raw unless you intend to mutate the original packet.

(raw []byte)

// alias raw — do not modify the returned pkt.raw unless you intend to mutate
// the original packet.
func parse(raw []byte) (pkt, error) {
	var p pkt
	if len(raw) < 20 {
		return p, errNotIPv4TCP
	}
	if raw[0]>>4 != 4 {
		return p, errNotIPv4TCP
	}
	p.ipHdrLen = int(raw[0]&0x0f) * 4
	if p.ipHdrLen < 20 || len(raw) < p.ipHdrLen+20 {
		return p, errNotIPv4TCP
	}
	if raw[9] != 6 { // IPPROTO_TCP
		return p, errNotIPv4TCP
	}
	p.totalLen = int(binary.BigEndian.Uint16(raw[2:4]))
	p.ident = binary.BigEndian.Uint16(raw[4:6])
	copy(p.srcIP[:], raw[12:16])
	copy(p.dstIP[:], raw[16:20])

	p.tcpOff = p.ipHdrLen
	p.tcpHdrLen = int(raw[p.tcpOff+12]>>4) * 4
	if p.tcpHdrLen < 20 || len(raw) < p.tcpOff+p.tcpHdrLen {
		return p, errNotIPv4TCP
	}
	p.srcPort = binary.BigEndian.Uint16(raw[p.tcpOff : p.tcpOff+2])
	p.dstPort = binary.BigEndian.Uint16(raw[p.tcpOff+2 : p.tcpOff+4])
	p.seqNum = binary.BigEndian.Uint32(raw[p.tcpOff+4 : p.tcpOff+8])
	p.ackNum = binary.BigEndian.Uint32(raw[p.tcpOff+8 : p.tcpOff+12])
	p.flags = raw[p.tcpOff+13]

	// Payload runs from end-of-headers to min(totalLen, len(raw)).
	// Clamp to len(raw) because some kernels deliver packets where
	// totalLen < buffer size (trailing padding) or > (truncated capture).
	payloadStart := p.tcpOff + p.tcpHdrLen
	ipEnd := p.totalLen
	if ipEnd > len(raw) {
		ipEnd = len(raw)
	}
	if payloadStart < ipEnd {
		p.payload = raw[payloadStart:ipEnd]
	}
	return p, nil
}

// TCP flag bit constants (byte 13 of TCP header).
const (